CVE-2024-0605: mozilla firefox_focus Race Condition

Vulnerability summary

CVE-2024-0605 is a high (CVSS 7.5) Race Condition vulnerability in mozilla firefox_focus. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.2% of scored vulnerabilities.

Timeline

1. 22-01-2024
   PublishedVulnerability first disclosed.
2. 20-06-2025
   Last modifiedVulnerability information updated.

Description

Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.